The AI Act for small businesses: which obligations apply, and since when

The AI Act — the European Artificial Intelligence Regulation — has stopped being something that would happen one day. Since 2 August 2026 its general application has been in force, and with it a block of obligations affecting any business that uses AI in front of the public. Small businesses included. Including when the AI you use was built by somebody else.

This guide sets out, without legalese, which AI Act obligations apply today to a small or medium business in Spain, which ones have been postponed, and what you can do this week to be comfortable.

Does the AI Act apply to small businesses?

Yes, and this is the most widespread misunderstanding. The regulation does not apply according to the size of your company, but according to what you do with AI and how risky that use is. A hair salon with a chatbot on its website is in scope. An accounting firm using AI to classify documents is in scope. A multinational that uses no AI is not.

What the regulation does do for smaller companies is scale things down: penalties are capped lower for small and medium enterprises, support channels are foreseen for them, and much of the heaviest weight falls on whoever builds the system rather than whoever uses it.

Provider or deployer: the distinction that changes everything

Before looking at any obligation, work out where you stand. The regulation distinguishes two main roles:

• Provider: whoever develops the AI system or puts it on the market under their own brand. Carries the bulk of the technical obligations.
• Deployer (the regulation's term for the professional user): whoever uses the system in their activity. The overwhelming majority of small businesses are here.

The practical consequence is the part that tends to surprise people: using somebody else's tool does not put you out of scope. If you embed a third-party chatbot on your website, you are still the deployer and you have obligations of your own. Fewer than the provider, but not none.

Which AI Act obligations are already in force

The regulation did not land all at once: it arrived in phases, and as of today three tranches apply.

• Since February 2025 — prohibited practices. Some uses of AI are simply banned: social scoring, emotion recognition at work or in education, biometric categorisation by sensitive characteristics, and manipulative techniques that exploit vulnerabilities. For a normal small business this is rarely an issue, but it is worth knowing the list exists before buying a tool that promises to "detect the mood" of your staff.
• Since February 2025 — AI literacy. This one touches everybody and almost nobody has done it. Anyone using AI in their activity must ensure a sufficient level of AI literacy among the staff who operate it. It does not require a degree: it requires that whoever uses the tool understands what it does, what it does not do, and where it goes wrong.
• Since August 2025 — general-purpose models. Obligations for whoever places general-purpose models on the market. That is the large labs' problem, not yours, unless you are building a model of your own.
• Since August 2026 — transparency. The tranche that changed day-to-day life for small businesses, and the one we unpack below.

Transparency: if AI answers for you, you have to say so

Article 50 of the regulation is by far the one that affects the most small businesses. In plain terms it says three things:

• If a person is talking to an AI, they must be told. The information has to be given at the latest at the first interaction, clearly and distinguishably. There is an exception where it is obvious from context to a reasonably informed person, but it is not worth leaning on: when in doubt, disclose.
• AI-generated or manipulated content must be marked in a machine-readable format. Systems already on the market before August 2026 get extra time to add that technical marking, and that window closes on 2 December 2026.
• Deepfakes and AI-generated public-interest text must be labelled. If you publish synthetic image, audio or video that appears authentic, you have to say so.

Concretely: if you have a chatbot on your site, an assistant on WhatsApp or an AI receptionist answering the phone, the person on the other end has the right to know they are not talking to a human. And the disclosure is yours to make even if somebody else built the system.

What has been postponed: the Digital Omnibus and high-risk systems

There is a 2026 development worth being clear about, because a lot of material published before the summer is no longer correct. The so-called Digital Omnibus, published in the Official Journal of the European Union in July 2026, pushed back the obligations for high-risk systems:

• Those in Annex III — employment and recruitment, education, access to essential services, biometrics — become enforceable on 2 December 2027.
• Those in Annex I, embedded in products already covered by sectoral legislation, move to 2 August 2028.

What was not postponed: prohibited practices, AI literacy and Article 50 transparency remain fully in force. The delay buys you room if you use AI to screen CVs — that is high risk, and more common in small businesses than people assume — but it does not excuse you from disclosing that your chatbot is a chatbot.

An AI Act compliance checklist for your business

• Take the inventory. List every AI tool that touches your business, including the ones bundled inside other software. Most small businesses discover two or three here that they did not know they had.
• Place each one. Are you the provider or the deployer? Does it interact with people? Does it touch decisions about employment, credit or access to services?
• Review the disclosures. Any system that talks to customers must identify itself as AI at the first interaction.
• Mark synthetic content and keep the December 2026 deadline in mind for systems that were already running.
• Train the team. The literacy obligation is met with proportionate, documented training, not with an expensive course.
• Keep the trail. Write down which tools you use, for what purpose, and what disclosures you give. If you are ever asked, the answer should be a document, not a reconstruction from memory.
• Ask your suppliers. Get it in writing from them how they comply. Their answer is part of your compliance.

How this fits an AI receptionist

An assistant that answers calls and messages is exactly the kind of system Article 50 has in mind, so we treat it as a design requirement rather than an add-on. Sara introduces herself as a virtual assistant at the start of the conversation, in whichever language she is addressed in, and hands the conversation to a person at the business when needed. The disclosure is not a note in the website footer: it is in the first sentence.

If you are weighing up automating processes with AI, the compliance question is worth asking before choosing a tool rather than after integrating one. Switching supplier over a requirement you did not account for costs far more than asking in time.

This guide is informational and does not replace legal advice: for a specific case, consult a professional. If you would like us to look at how AI fits your business and what applies to you, tell us about your case and we will put together a tailored proposal.